Upgrade to Pro — share decks privately, control downloads, hide ads and more …

syscalls - gate to the linux kernel

syscalls - gate to the linux kernel

Bernhard M. Wiedemann

June 27, 2016
Tweet

More Decks by Bernhard M. Wiedemann

Other Decks in Technology

Transcript

  1. On the Kernel-Side • http://lxr.free-electrons.com/source/fs/open.c#L1023 SYSCALL_DEFINE3(open, const char __user *,

    filename, int, flags, umode_t, mode) { if (force_o_largefile()) flags |= O_LARGEFILE; return do_sys_open(AT_FDCWD, filename, flags, mode); }
  2. bootcd:/ # echo newuser::500:500:TestUser:/home/newuser:/bin/bash >>/etc/passwd bash: /etc/passwd: Read­only file system

    bootcd:/ # insmod translucency Using /lib/modules/2.4.18­4GB/kernel/fs/translucency.o bootcd:/ # echo "/ ­> /var/tmp" > /proc/sys/translucency/0 bootcd:/ # echo newuser::500:500:TestUser:/home/newuser:/bin/bash >>/etc/passwd bootcd:/ # tail ­3 /etc/passwd perforce:x:68:60:perfoce admin:/var/lib/perforce:/bin/false nobody:x:65534:65534:nobody:/var/lib/nobody:/bin/bash newuser::500:500:TestUser:/home/newuser:/bin/bash bootcd:/ # echo > /proc/sys/translucency/0 bootcd:/ # rmmod translucency bootcd:/ # tail ­3 /etc/passwd pop:x:67:100:pop admin:/var/lib/pop:/bin/false perforce:x:68:60:perfoce admin:/var/lib/perforce:/bin/false nobody:x:65534:65534:nobody:/var/lib/nobody:/bin/bash bootcd:/ # ls ­l /var/tmp/etc/ total 4 drwxr­xr­x 2 root root 0 May 11 15:51 . drwxrwxrwt 6 root root 0 May 11 15:51 .. ­rw­r­­r­­ 1 root root 2852 May 11 15:51 passwd bootcd:/ # What else you can do with syscalls